Requesting an expedited build of v0.63.5

[sparkwise]

Metabase posted a security advisory today about a zero-day vulnerability giving access to admin accounts. Self-hosted users running Metabase 63 prior to 0.63.5 are vulnerable. I went to update to v0.63.5, and see that it isn't available yet on Cloudron. Requesting an expedited build.

[sparkwise]

Until then, the recommended temporary workaround is for users to block the affected endpoint (/api/session/reset_password).

[luckow]

mh. this release isn’t available https://github.com/metabase/metabase/releases

please add a link to your source.

[sparkwise]

@luckow I emailed Metabase to ask about the missing release.

Notification email came from company CEO sent out earlier this morning. I tried to upload a PDF of the email but can't upload PDF to this forum.

[sparkwise]

@luckow Found it here: https://hub.docker.com/r/metabase/metabase/tags?name=v0.63.5

[joseph]

I guess the question is how did you know it has a security issue (or how did your CEO know?) https://www.metabase.com/changelog/63 has no info on this release either .

[sparkwise]

@joseph The CEO of Metabase (not my company’s CEO) sent an email out to their email list. I sent a response to help@metabase.com and they replied immediately to confirm. I’d recommend reaching out to them to confirm. I’ll forward the full email to the Cloudron email account.

[joseph]

Ha ha ok, I misunderstood @james it seems https://downloads.metabase.com/v0.63.5/metabase.jar is available , so we may have to create a manual MR .

[milian.hackradt]

Here's the security advisories for anyone interested:
https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf
https://github.com/metabase/metabase/security/advisories/GHSA-8hmm-hrhg-ppqp
https://github.com/metabase/metabase/security/advisories/GHSA-r8h2-qpfx-mx59

Interestingly, the GitHub Advisory Database includes links to the patched versions while GitHub Releases do not even show these (as of today). There must be a lot of chaos going on behind the scenes since their cloud offering was also breached and has affected fairly big customers (e.g. Framework): https://community.frame.work/t/framework-data-breach-discussion/83939

This app is a great candidate for the VPN Protection coming with Cloudron 10